1 /*	$OpenBSD: imsg-buffer.c,v 1.14 2022/04/23 08:57:52 tobias Exp $	*/
2 
3 /*
4  * Copyright (c) 2003, 2004 Henning Brauer <henning@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/types.h>
20 #include <sys/queue.h>
21 #include <sys/socket.h>
22 #include <sys/uio.h>
23 
24 #include <limits.h>
25 #include <errno.h>
26 #include <stdlib.h>
27 #include <string.h>
28 #include <unistd.h>
29 
30 #include "imsg.h"
31 
32 static int	ibuf_realloc(struct ibuf *, size_t);
33 static void	ibuf_enqueue(struct msgbuf *, struct ibuf *);
34 static void	ibuf_dequeue(struct msgbuf *, struct ibuf *);
35 
36 struct ibuf *
37 ibuf_open(size_t len)
38 {
39 	struct ibuf	*buf;
40 
41 	if ((buf = calloc(1, sizeof(struct ibuf))) == NULL)
42 		return (NULL);
43 	if ((buf->buf = malloc(len)) == NULL) {
44 		free(buf);
45 		return (NULL);
46 	}
47 	buf->size = buf->max = len;
48 	buf->fd = -1;
49 
50 	return (buf);
51 }
52 
53 struct ibuf *
54 ibuf_dynamic(size_t len, size_t max)
55 {
56 	struct ibuf	*buf;
57 
58 	if (max < len)
59 		return (NULL);
60 
61 	if ((buf = ibuf_open(len)) == NULL)
62 		return (NULL);
63 
64 	if (max > 0)
65 		buf->max = max;
66 
67 	return (buf);
68 }
69 
70 static int
71 ibuf_realloc(struct ibuf *buf, size_t len)
72 {
73 	unsigned char	*b;
74 
75 	/* on static buffers max is eq size and so the following fails */
76 	if (len > SIZE_MAX - buf->wpos || buf->wpos + len > buf->max) {
77 		errno = ERANGE;
78 		return (-1);
79 	}
80 
81 	b = recallocarray(buf->buf, buf->size, buf->wpos + len, 1);
82 	if (b == NULL)
83 		return (-1);
84 	buf->buf = b;
85 	buf->size = buf->wpos + len;
86 
87 	return (0);
88 }
89 
90 int
91 ibuf_add(struct ibuf *buf, const void *data, size_t len)
92 {
93 	if (len > SIZE_MAX - buf->wpos) {
94 		errno = ERANGE;
95 		return (-1);
96 	}
97 
98 	if (buf->wpos + len > buf->size)
99 		if (ibuf_realloc(buf, len) == -1)
100 			return (-1);
101 
102 	memcpy(buf->buf + buf->wpos, data, len);
103 	buf->wpos += len;
104 	return (0);
105 }
106 
107 void *
108 ibuf_reserve(struct ibuf *buf, size_t len)
109 {
110 	void	*b;
111 
112 	if (len > SIZE_MAX - buf->wpos) {
113 		errno = ERANGE;
114 		return (NULL);
115 	}
116 
117 	if (buf->wpos + len > buf->size)
118 		if (ibuf_realloc(buf, len) == -1)
119 			return (NULL);
120 
121 	b = buf->buf + buf->wpos;
122 	buf->wpos += len;
123 	return (b);
124 }
125 
126 void *
127 ibuf_seek(struct ibuf *buf, size_t pos, size_t len)
128 {
129 	/* only allowed to seek in already written parts */
130 	if (len > SIZE_MAX - pos || pos + len > buf->wpos)
131 		return (NULL);
132 
133 	return (buf->buf + pos);
134 }
135 
136 size_t
137 ibuf_size(struct ibuf *buf)
138 {
139 	return (buf->wpos);
140 }
141 
142 size_t
143 ibuf_left(struct ibuf *buf)
144 {
145 	return (buf->max - buf->wpos);
146 }
147 
148 void
149 ibuf_close(struct msgbuf *msgbuf, struct ibuf *buf)
150 {
151 	ibuf_enqueue(msgbuf, buf);
152 }
153 
154 int
155 ibuf_write(struct msgbuf *msgbuf)
156 {
157 	struct iovec	 iov[IOV_MAX];
158 	struct ibuf	*buf;
159 	unsigned int	 i = 0;
160 	ssize_t	n;
161 
162 	memset(&iov, 0, sizeof(iov));
163 	TAILQ_FOREACH(buf, &msgbuf->bufs, entry) {
164 		if (i >= IOV_MAX)
165 			break;
166 		iov[i].iov_base = buf->buf + buf->rpos;
167 		iov[i].iov_len = buf->wpos - buf->rpos;
168 		i++;
169 	}
170 
171 again:
172 	if ((n = writev(msgbuf->fd, iov, i)) == -1) {
173 		if (errno == EINTR)
174 			goto again;
175 		if (errno == ENOBUFS)
176 			errno = EAGAIN;
177 		return (-1);
178 	}
179 
180 	if (n == 0) {			/* connection closed */
181 		errno = 0;
182 		return (0);
183 	}
184 
185 	msgbuf_drain(msgbuf, n);
186 
187 	return (1);
188 }
189 
190 void
191 ibuf_free(struct ibuf *buf)
192 {
193 	if (buf == NULL)
194 		return;
195 	freezero(buf->buf, buf->size);
196 	free(buf);
197 }
198 
199 void
200 msgbuf_init(struct msgbuf *msgbuf)
201 {
202 	msgbuf->queued = 0;
203 	msgbuf->fd = -1;
204 	TAILQ_INIT(&msgbuf->bufs);
205 }
206 
207 void
208 msgbuf_drain(struct msgbuf *msgbuf, size_t n)
209 {
210 	struct ibuf	*buf, *next;
211 
212 	for (buf = TAILQ_FIRST(&msgbuf->bufs); buf != NULL && n > 0;
213 	    buf = next) {
214 		next = TAILQ_NEXT(buf, entry);
215 		if (n >= buf->wpos - buf->rpos) {
216 			n -= buf->wpos - buf->rpos;
217 			ibuf_dequeue(msgbuf, buf);
218 		} else {
219 			buf->rpos += n;
220 			n = 0;
221 		}
222 	}
223 }
224 
225 void
226 msgbuf_clear(struct msgbuf *msgbuf)
227 {
228 	struct ibuf	*buf;
229 
230 	while ((buf = TAILQ_FIRST(&msgbuf->bufs)) != NULL)
231 		ibuf_dequeue(msgbuf, buf);
232 }
233 
234 int
235 msgbuf_write(struct msgbuf *msgbuf)
236 {
237 	struct iovec	 iov[IOV_MAX];
238 	struct ibuf	*buf, *buf0 = NULL;
239 	unsigned int	 i = 0;
240 	ssize_t		 n;
241 	struct msghdr	 msg;
242 	struct cmsghdr	*cmsg;
243 	union {
244 		struct cmsghdr	hdr;
245 		char		buf[CMSG_SPACE(sizeof(int))];
246 	} cmsgbuf;
247 
248 	memset(&iov, 0, sizeof(iov));
249 	memset(&msg, 0, sizeof(msg));
250 	memset(&cmsgbuf, 0, sizeof(cmsgbuf));
251 	TAILQ_FOREACH(buf, &msgbuf->bufs, entry) {
252 		if (i >= IOV_MAX)
253 			break;
254 		if (i > 0 && buf->fd != -1)
255 			break;
256 		iov[i].iov_base = buf->buf + buf->rpos;
257 		iov[i].iov_len = buf->wpos - buf->rpos;
258 		i++;
259 		if (buf->fd != -1)
260 			buf0 = buf;
261 	}
262 
263 	msg.msg_iov = iov;
264 	msg.msg_iovlen = i;
265 
266 	if (buf0 != NULL) {
267 		msg.msg_control = (caddr_t)&cmsgbuf.buf;
268 		msg.msg_controllen = sizeof(cmsgbuf.buf);
269 		cmsg = CMSG_FIRSTHDR(&msg);
270 		cmsg->cmsg_len = CMSG_LEN(sizeof(int));
271 		cmsg->cmsg_level = SOL_SOCKET;
272 		cmsg->cmsg_type = SCM_RIGHTS;
273 		*(int *)CMSG_DATA(cmsg) = buf0->fd;
274 	}
275 
276 again:
277 	if ((n = sendmsg(msgbuf->fd, &msg, 0)) == -1) {
278 		if (errno == EINTR)
279 			goto again;
280 		if (errno == ENOBUFS)
281 			errno = EAGAIN;
282 		return (-1);
283 	}
284 
285 	if (n == 0) {			/* connection closed */
286 		errno = 0;
287 		return (0);
288 	}
289 
290 	/*
291 	 * assumption: fd got sent if sendmsg sent anything
292 	 * this works because fds are passed one at a time
293 	 */
294 	if (buf0 != NULL) {
295 		close(buf0->fd);
296 		buf0->fd = -1;
297 	}
298 
299 	msgbuf_drain(msgbuf, n);
300 
301 	return (1);
302 }
303 
304 static void
305 ibuf_enqueue(struct msgbuf *msgbuf, struct ibuf *buf)
306 {
307 	TAILQ_INSERT_TAIL(&msgbuf->bufs, buf, entry);
308 	msgbuf->queued++;
309 }
310 
311 static void
312 ibuf_dequeue(struct msgbuf *msgbuf, struct ibuf *buf)
313 {
314 	TAILQ_REMOVE(&msgbuf->bufs, buf, entry);
315 
316 	if (buf->fd != -1)
317 		close(buf->fd);
318 
319 	msgbuf->queued--;
320 	ibuf_free(buf);
321 }